PT-2023-32785 · Wso2 · Wso2

Published 2023-12-15 · Updated 2025-06-05 · CVE-2023-6837

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description The issue allows a malicious actor to perform user impersonation using JIT provisioning under specific conditions. These conditions include an IDP configured for federated authentication with JIT provisioning enabled and the "Prompt for username, password and consent" option, as well as a service provider using the IDP for federated authentication with the "Assert identity using mapped local subject identifier" flag enabled. The attacker must have a fresh valid user account in the federated IDP and knowledge of the username of a valid user in the local IDP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-6837

GHSA-F6JM-9PR8-9C3W

Affected Products

Wso2

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-6837 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6837 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6jm-9pr8-9c3w · Vendor Advisory
• https://github.com/wso2/carbon-identity-framework/commit/fdab609760784086b8a3f55f7acf46d977a03d79 · Note
• https://github.com/wso2/identity-apps/commit/1424203bbe81688d661ea8b8cd28e332302e1c53 · Note
• https://twitter.com/VulmonFeeds/status/1735625229202808931 · Twitter Post
• https://twitter.com/CVEnew/status/1735598651848949859 · Twitter Post
• https://t.me/cvenotify/80095 · Telegram Post
• https://t.me/cvenotify/66450 · Telegram Post
• https://t.me/cvenotify/124733 · Telegram Post